0022437: Change encryption of passwords to openssl decrypt and encrypt

ID	Project	Category	View Status	Date Submitted	Last Update
0022437	Plugin - EmailReporting	General	public	2017-02-28 14:00	2026-10-28 19:25

Reporter	SL-Gundam	Assigned To	SL-Gundam
Priority	normal	Severity	feature	Reproducibility	N/A
Status	resolved	Resolution	fixed
Product Version	0.10.0

Summary	0022437: Change encryption of passwords to openssl decrypt and encrypt
Description	https://secure.php.net/openssl_decrypt https://secure.php.net/openssl_encrypt Currently EmailReporting is only using base64. Need to think about the encryption key... maybe the crypto_master_salt or something like that
Tags	No tags attached.

rogueresearch 2021-01-06 13:00 reporter ~0064939	Is this still the case? (I am evaluating using this plugin.)

SL-Gundam 2021-01-06 19:56 manager ~0064950	The mail systems require the actual password which required EmailReporting to use reversible encryption. For the new functions OpenSSL is required. Currently that is optional for EmailReporting so Base64 was chosen at the time. We are only talking about the passwords to the mailboxes EmailReporting is monitoring. These are only vulnerable if somebody actually was able to access your database directly or found a flaw which allowed the person to access data normally not available for non-admin MantisBT users.

SL-Gundam 2026-10-28 19:25 manager ~0071546	Encryption has been updated. https://github.com/mantisbt-plugins/EmailReporting/commit/1dad746c6ed58e0c8de9ad64de2e96c4bd76ec85